How software gets permission today
9 hours ago
- The three fundamental questions of IAM are identity, authentication, and authorization, in that order, with authorization being continuous and often the hardest to implement correctly.
- Authorization models include ACLs, RBAC, ABAC, and ReBAC, each with trade-offs; real systems typically combine them using roles for coarse access, relationships for ownership, and attributes for fine-grained conditions.
- Broken access control is the top OWASP risk, with common failures like IDOR, missing function checks, confused deputies, privilege creep, and over-permissioned accounts.
- OAuth 2.0 enables delegated authorization using access tokens (valet keys), while scopes limit what a client can do within the user's authority.
- Policy engines centralize authorization logic into a single rulebook, making rules testable and auditable, but face challenges with data consistency and enforcement across all endpoints.
- Machine identities (service accounts) now outnumber human identities and require careful permission management, with workload identity federation offering a modern alternative to static secrets.
- The current authorization machinery assumes known actors with predictable requests, but this assumption breaks down when software acts autonomously on behalf of humans.